Google Chrome Stable Update Fixes Eight Vulnerabilities, Including Multiple Use-After-Free Flaws

What happened

Google's Chrome Releases (Stable) blog announced an update to the desktop Stable channel that resolves eight vulnerabilities. Four of these are use-after-free (CWE-416) issues located in distinct Chrome components: Media (CVE-2026-106383), Parser (CVE-2026-106193), WebRTC (CVE-2026-106268), WebRTC again (CVE-2026-106357), and Bindings (CVE-2026-106248) — five use-after-free CVEs in total. The remaining three vulnerabilities involve information leaks in Autofill (CVE-2026-106342, CWE-200) and Passwords (CVE-2026-106220, CWE-200), and an incorrect authorization issue in Selection on iOS (CVE-2026-106309, CWE-863). All eight were described as exploitable via a crafted HTML page.

Technical cause

The use-after-free vulnerabilities (CVE-2026-106383, CVE-2026-106193, CVE-2026-106268, CVE-2026-106357, CVE-2026-106248) stem from memory being accessed after it has already been freed, within the Media, Parser, WebRTC, and Bindings components respectively. Chromium rated these as High severity because, per the vendor description, they could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The information leak vulnerabilities (CVE-2026-106342 in Autofill, CVE-2026-106220 in Passwords) are classified as CWE-200 (exposure of sensitive information) and were rated Medium and Low severity respectively by Chromium. CVE-2026-106309, an incorrect authorization flaw (CWE-863) in the Selection component on iOS, was rated Low severity by Chromium and could allow a remote attacker to obtain sensitive information via a crafted HTML page.

Why it matters

The use-after-free issues are notable because successful exploitation could allow an attacker to run arbitrary code inside Chrome's sandbox simply by getting a user to load a crafted HTML page. While sandbox escape would require an additional vulnerability, code execution inside the sandbox is still a meaningful risk, particularly when chained with other flaws. The information leak and authorization issues are lower severity per Chromium's own rating but could still expose sensitive data such as autofill or password-related information to a remote attacker.

Who is affected

All users running Google Chrome on desktop prior to version 155.0.8059.39 are affected by these vulnerabilities. CVE-2026-106309 specifically affects Chrome on iOS prior to the same version.

Affected versions

Google Chrome versions prior to 155.0.8059.39 are affected by all eight vulnerabilities described in this briefing.

Fixes and mitigation

Google has fixed all eight vulnerabilities in Chrome 155.0.8059.39, released via the Stable Channel Update for Desktop. No workarounds are described in the available source material beyond updating to the fixed version.

Recommended action

Update Google Chrome to version 155.0.8059.39 or later. Most installations update automatically on restart; users and administrators should verify their version via the browser's About page and restart the browser to apply the update promptly, given the High-severity use-after-free issues included in this release.